Active Directory and VPN tunnels

[Darksamie]

I have a query about Active directory and what you can and cannot do -

I have a VPN set up between a few of my offices and wanted to add another branch office in to the mix. From what I understand of AD, I would need to create tunnels from this office to every other office which has an AD server of the same domain.

Is there any way around this?

The reason why I ask is that the firewall we have in this smaller office can only handle one VPN connection and hence cannot have a tunnel to the other offices (therefore no ability to replicate the AD).

Anyone knowledgeable on this?

 

[Nothinman]

You could always use a dedicated line between offices. Putting one of the AD boxes directly on the Internet infront of the firewalls would also probably work, but it would be really, really stupid.

 

[Darksamie]

A dedicated line between offices would not help in this scenario. I would need dedicated line(s) due to the fact that it is a many to many connection.

ie. In the case of 4 offices, there would need to be 3 lines from each office to each office.

 

[Nothinman]

It would help, it would just be a lot more expensive =)

 

[KB]

Originally posted by: Darksamie

I have a query about Active directory and what you can and cannot do -

I have a VPN set up between a few of my offices and wanted to add another branch office in to the mix. From what I understand of AD, I would need to create tunnels from this office to every other office which has an AD server of the same domain.

Is there any way around this?
/q]

Nope. There are two AD replication protocols. They are discussed here: http://www.microsoft.com/technet/prodte...edirectory/deploy/projplan/adarch.mspx

Replication Protocols

Directory information can be exchanged using the following network protocols:
?

IP replication. IP replication uses remote procedure calls (RPC) for replication within a site (intra-site) and over site links (inter-site). By default, inter-site IP replication adheres to replication schedules. IP replication does not require a certification authority (CA).
?

SMTP replication. If you have a site that has no physical connection to the rest of you network but that can be reached via Simple Mail Transfer protocol (SMTP), that site has mail-based connectivity only. SMTP replication is used only for replication between sites. You cannot use SMTP replication to replicate between domain controllers in the same domain?only inter-domain replication is supported over SMTP (that is, SMTP can be used only for inter-site, inter-domain replication). SMTP replication can be used only for schema, configuration, and global catalog partial replica replication. SMTP replication observes the automatically generated replication schedule.

If you choose to use SMTP over site links, you must install and configure an enterprise certification authority (CA). The domain controllers obtain certificates from the CA, which the domain controllers then use to sign and encrypt the mail messages that contain directory replication information, ensuring the authenticity of directory updates. SMTP replication uses 56-bit encryption.



You could use SMTP synchronization over the internet but it is complicated and it can't be used to synchronize domain controllers in the same domain.

 

[Booty]

What kind of firewall(s) do you have? I wouldn't think you'd have to spend a ton of a money to upgrade them... then again, I'm no expert.

 

[spyordie007]

Why connect every office to every other office (a full mesh)? You could always do a hub or ring topology and that would greatly simplify administration.

See KB's post; you've got a couple of options for AD replication. I suggest that regardless of what you choose that the replication between DCs occurs through a secure chanel (dedicated lines or a VPN).

 

[Darksamie]

You are correct - the replication has to accur across an encrypted channel, however I think meshing will be the only way possible.

Looks like I will have to upgrade the firewall there.

In answer to a previous post - I am using Watchguard Firebox 700's in 3 locations, and a Firebox SOHO in the problem one.

 

[spyordie007]

I think meshing will be the only way possible.

Why? Active Directory certainly doesnt need it; do you have other applications that require it?

 

[Darksamie]

Do you know of any information which would explain changing the AD topology?